lessons learned - cdn.ymaws.com€¦ · aaron robison senior project manager. 1. awia –it’s the...

AWIARisk & Resilience Assessment & Emergency Response PlanLessons Learned

HDR Introductions

David Carani

Water Quality Section Manager

Roger Null

National Utility Planning Lead & AWIA Lead

Aaron Robison

Senior Project Manager

1. AWIA – It’s the Law!

2. National Standard – AWWA J100

3. MO Pending Legislation

4. Lessons Learned

5. MPUA Toolkits

6. Open Discussion

Agenda

Natural Hazards Risks – not if but when!

Community Water Systems serving more than 3,300 persons must:

✓Risk and Resilience Assessment (RRA)

✓Update Emergency Response Plan (ERP)

✓Submit Certification to EPA for each

✓Review and update every 5 years

✓Record maintenance

America’s Water Infrastructure Act of 2018 (AWIA)

But I did a Vulnerability Assessment…What’s Different Now?

AWIA Requirements – Prepare and Certify RRA & ERPs

Community Water

System (pop. served)

Certify Risk & Resilience

Assessment (RRA) prior to:

Certify ERP within 6 months of

RRA, but not later than:

>100K March 31, 2020 September 30, 2020

50K to 100K December 31, 2020 June 30, 2021

3,300 to <50K June 30, 2021 December 30, 2021

What if No Letter is Submitted? Utility is subject to enforcement action by EPA under §1414 of SDWA

Penalty up to $25,000 per day

What Must a Utility Assess?

• Pipes and constructed conveyances

• Physical barriers

• Source water

• Water collection and intake

• Pretreatment, treatment, storage and distribution facilities

• Electronic, computer, or other automated systems

All Critical Components of the System

Harmful Algal Blooms (HABs)

• Earthy / Musty Culprits

• Methyl Iso-Borneol (MIB)

• Geosmin

• Odor Threshold 5 to 10 ng/L

• Erodes public confidence

Example Source Water Concerns

• Malevolent Acts and Natural Hazards

• Monitoring practices of the system

• Financial infrastructure

• Use, storage, or handling of various chemicals

• Operation and maintenance of the system

• May include evaluation of capital and operational needs for risk and resilience management

What Must a Utility Assess?

Natural Hazard Vulnerability/Risk Assessment

• Hurricane

• Tornado

• Flooding

• Earthquake

• Wildfire

• Fire

• Erosion/Landslide

• Dam Failure

• Extreme Heat/Algae Blooms

• Drought

• Storms/Lightning/Hail

• Winter Weather

• Animals

Human-Caused Hazard Vulnerability Risk/Assessment• Vandalism

• Physical Sabotage – Internal & External

• Physical Sabotage - External

• Cyber – Internal & External

• Terrorism

• Contamination – Accidental & Intentional

• Dependency – Loss of Power

• Dependency – Loss of Supply Chain

• Dependency – Loss of Staff

• Dependency – Human Error/Neglect

• Dependency - Loss of Communication

• Transportation Accidents/Incident

• Hazmat Incident

• Proximity Hazard

An Integrated Project Approach to AWIA Compliance Provides a Resilience Milestone

What do you want to get out of the RRA & ERP?

National Standard –AWWA J100

• Industry Standard for water and wastewater utilities

• Adopted as an ANSI Standard in 2010

• US SAFETY Act Approved

• All-hazards approach

• Provides due diligence

1. Asset Characterization

2. Threat Characterization

3. Consequence Analysis

4. Vulnerability Analysis

5. Threat Analysis

6. Risk/Resilience Analysis

7. Risk/Resilience Management

Cyber Security is getting a lot of attention locally.

AWWA J100 Standard –7 Step Process

RRA Report ERP Report

• Documents Process and Decision

• J100 Workbook (spreadsheet tool)

• Critical Asset Summary Sheets

• Mitigation Measures and Implementation Plan

• Physical and cybersecurity strategies

• Response plans, procedures, and equipment

• Specific actions to lessen impact on public health

• Detection strategies

RRA & ERP Certification Letter

Certification of Review Every Five Years

Guidance Document M19

• Emergency Planning for Water and Wastewater Utilities

• Manual that provides detailed best practices to meet industry standards.

• Originally issued in 1973 and was last updated in 2018.

• Consensus of the water sector

Our ERP Gap Assessment Approach Focuses Our Efforts in these Key Areas

2003 Water Utility ERP

Existing Water Utility ERP

Existing City/County ERP

WARN/EMAC

GAP Assessment

2020/2021 AWIA ERP

Update

Guidelines, Standards,

and RRA Findings

• State-based ERP Guidelines

• AWIA Federal ERP

Guidelines

• AWWA M19-18 - Emergency

Planning Manual

• ANSI/AWWA G440-17 -

Emergency Preparedness

Practices

• AWIA RRA Findings (J100

Standard)

ERP Response

Training

Exercises

BCP/COOP

Alignment

SCADA/IT Assessment Required by the AWIA – HB 2120?

Can be a tiered approach

1. Begin with the free AWWA Cyber Security Tool for basic identification of issues

2. Consider more in-depth Cyber audit after the basics are improved

3. Utilize additional detailed evaluation tools and testing after the basics are improved

Cybersecurity

• Governor Parson’s signed in July 2020

• Applies to all cities less than 30,000 population

• Must develop and implement:

• Cyber Risk Plan

• Valve Inspection Program

• Hydrant Inspection Program

• Provide compliance reports upon request by DNR

• Voluntary Lead Testing in Public Elementary Schools

Missouri House Bill 2120

Effective Tools, Resources & Strategies

Key Lessons Learned

• Collaboration is important

• Scalable effort based on objective

• Field inspection is important

• Mitigation measure identification and implementation are needed

• Mitigation measures must go beyond physical security

• Pandemic planning is more important now

• Business continuity planning is key

• Training is essential

Assessment Tools• Many tools - no singular solution

• Customized tools

• EPA – VSAT 2.0

• EPA - Small System RRA Checklist

• AEM – PARRE

• AWWA Cybersecurity Tool

• ESRI Survey123

• UAS (Drone) Technology

• Detailed Model Analysis

• EPA Response Protocol Toolbox (ERP)

• Different approaches fit different utilities – what is your objective?

• Minimum compliance?

• Commitment to risk and resilience management?

• Commitment to integrated assessment, planning and management approach?

Small Utility Checklists

• For utilities 3,300 to <50,000

• Help small systems meet AWIA RRA requirements

• Does not cover all aspects of water system security & resilience

• Asset management

• Climate change

• Emergency preparedness & response

Comparison of the Checklist and VSAT

• EPA published VSAT Web 2.0 in August 2019 to assist larger systems with risk assessments to comply with AWIA

*EPA (2020) America’s Water Infrastructure Act (AWIA) Risk and Resilience Checklist and Lessons Learned

https://www.epa.gov/water-research/small-systems-monthly-webinar-series

https://www.epa.gov/water-research/small-systems-monthly-webinar-series

MPUA and HDR: AWIA and CS Asset Management Tool Kits